Researchers at Positive Technologies have disclosed two high-severity vulnerabilities in PHP’s PDO extension layer one causing a NULL pointer dereference that crashes PHP worker processes, and another enabling SQL injection through a subtle mishandling of NUL bytes in the Firebird driver.
The findings emerged from a broad audit of PHP’s database abstraction infrastructure and expose weaknesses in trust boundaries that web developers have relied on for years.
All database communication flows through extensions, either via the generic PDO (PHP Data Objects) interface backed by driver-specific modules such as pdo_pgsql or pdo_firebird, or through native extensions like mysqli and pgsql.
Internally, each driver delegates to a DBMS client library libpq for PostgreSQL, fbclient for Firebird or to an embedded engine like SQLite.
The scope of Positive Technologies’ audit quickly widened.
Beyond PDO itself, researchers uncovered an integer overflow in PostgreSQL’s libpq client library and an information disclosure flaw in Firebird 3’s fbclient, where incorrect XSQLDA field lengths during communication with Firebird 4 servers can trigger an out-of-bounds read.
But the two most critical findings center on PDO’s own drivers.
PostgreSQL Bug Crashes PHP
CVE-2025-14180 (CVSS 8.2 HIGH) affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.
The vulnerability is triggered when the pdo_pgsql driver operates with PDO::ATTR_EMULATE_PREPARES enabled a configuration that shifts prepared statement handling entirely to the PHP side rather than delegating it to the PostgreSQL server.
In this emulation mode, PHP’s pdo_parse_params() function processes parameter values before sending a completed SQL string to PostgreSQL.
When an invalid character sequence such as the byte \x99 is supplied in a parameter, the underlying libpq quoting function PQescapeStringConn() returns NULL instead of an escaped string.
PHP’s pdo_parse_params() does not validate this return value before dereferencing the pointer, resulting in a NULL pointer dereference, a segmentation fault, and a crash of the PHP worker process.
A remote attacker can exploit this without authentication by submitting a malformed character sequence through any application input field that reaches a prepared statement, effectively taking down the PHP-FPM worker or the web server process handling that request a straightforward Denial of Service condition.
The fix requires upgrading to a patched PHP release; alternatively, disabling PDO::ATTR_EMULATE_PREPARES in PostgreSQL connection settings eliminates the vulnerable code path, ptsecurity said.
CVE-2025-14179 (High severity, CWE-89) affects PHP versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6.
The vulnerability is counterintuitive: the PDO_Firebird quoting routine firebird_handle_quoter(), exposed via PDO::quote(), behaves correctly and produces properly escaped output.
The bug fires later, during PDO::prepare(), when the driver reparses and reconstructs the SQL string token by token.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
